@socketsecurity/lib 6.0.2 → 6.0.4

package/dist/process/spawn/_internal.js

@@ -1,62 +1,50 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var internal_exports = {};
-__export(internal_exports, {
-  getNpmCliPromiseSpawn: () => getNpmCliPromiseSpawn,
-  spawnBinPathCache: () => spawnBinPathCache,
-  stackCache: () => stackCache,
-  stripAnsiFromSpawnResult: () => stripAnsiFromSpawnResult,
-  windowsScriptExtRegExp: () => windowsScriptExtRegExp
-});
-module.exports = __toCommonJS(internal_exports);
-var import_strip = require("../../ansi/strip");
-var import_map_set = require("../../primordials/map-set");
-const stackCache = new import_map_set.WeakMapCtor();
-const spawnBinPathCache = new import_map_set.MapCtor();
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../../primordials/map-set.js');
+const require_ansi_strip = require('../../ansi/strip.js');
+
+//#region src/process/spawn/_internal.ts
+/**
+* @file Private internals for `spawn/*` modules — the `@npmcli/promise-spawn`
+*   lazy loader, the per-spawn ANSI-stripping helper, the WeakMap stack cache,
+*   and the binary-path cache shared between `spawn` and `spawnSync`.
+*   Underscore prefix excludes this file from the public exports map.
+*/
+const stackCache = new require_primordials_map_set.WeakMapCtor();
+const spawnBinPathCache = new require_primordials_map_set.MapCtor();
 const windowsScriptExtRegExp = /\.(?:cmd|bat|ps1)$/i;
 let _npmCliPromiseSpawn;
-// @__NO_SIDE_EFFECTS__
+/**
+* Lazily load the `@npmcli/promise-spawn` module to avoid Webpack bundling
+* issues. Required because the upstream module uses CJS dynamic-require
+* patterns that Webpack flags.
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function getNpmCliPromiseSpawn() {
-  if (_npmCliPromiseSpawn === void 0) {
-    _npmCliPromiseSpawn = require("../../external/@npmcli/promise-spawn");
-  }
-  return _npmCliPromiseSpawn;
+	if (_npmCliPromiseSpawn === void 0) _npmCliPromiseSpawn = /* @__PURE__ */ require("../../external/@npmcli/promise-spawn");
+	return _npmCliPromiseSpawn;
 }
-// @__NO_SIDE_EFFECTS__
+/**
+* Strip ANSI escape codes from spawn result stdout and stderr. Modifies the
+* result object in place to remove color codes and formatting.
+*
+* @param {unknown} result - Spawn result object with stdout/stderr properties.
+*
+* @returns {unknown} The modified result object
+*/
+/* @__NO_SIDE_EFFECTS__ */
 function stripAnsiFromSpawnResult(result) {
-  const res = result;
-  const { stderr, stdout } = res;
-  if (typeof stdout === "string") {
-    res.stdout = (0, import_strip.stripAnsi)(stdout);
-  }
-  if (typeof stderr === "string") {
-    res.stderr = (0, import_strip.stripAnsi)(stderr);
-  }
-  return res;
+	const res = result;
+	const { stderr, stdout } = res;
+	if (typeof stdout === "string") res.stdout = /* @__PURE__ */ require_ansi_strip.stripAnsi(stdout);
+	if (typeof stderr === "string") res.stderr = /* @__PURE__ */ require_ansi_strip.stripAnsi(stderr);
+	return res;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  getNpmCliPromiseSpawn,
-  spawnBinPathCache,
-  stackCache,
-  stripAnsiFromSpawnResult,
-  windowsScriptExtRegExp
-});
+
+//#endregion
+exports.getNpmCliPromiseSpawn = getNpmCliPromiseSpawn;
+exports.spawnBinPathCache = spawnBinPathCache;
+exports.stackCache = stackCache;
+exports.stripAnsiFromSpawnResult = stripAnsiFromSpawnResult;
+exports.windowsScriptExtRegExp = windowsScriptExtRegExp;

package/dist/process/spawn/child.js

@@ -1,216 +1,177 @@
 "use strict";
-/* Socket Lib - Built with esbuild */
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var child_exports = {};
-__export(child_exports, {
-  spawn: () => spawn,
-  spawnSync: () => spawnSync
-});
-module.exports = __toCommonJS(child_exports);
-var import_node_process = __toESM(require("node:process"));
-var import_which = require("../../bin/which");
-var import_abort = require("../../process/abort");
-var import_child_process = require("../../node/child-process");
-var import_fs = require("../../node/fs");
-var import_path = require("../../node/path");
-var import_inspect = require("../../objects/inspect");
-var import_normalize = require("../../paths/normalize");
-var import_regexp = require("../../primordials/regexp");
-var import_default = require("../../spinner/default");
-var import_internal = require("./_internal");
-var import_errors = require("./errors");
-var import_stdio = require("./stdio");
-const abortSignal = (0, import_abort.getAbortSignal)();
-const spinner = (0, import_default.getDefaultSpinner)();
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_runtime = require('../../_virtual/_rolldown/runtime.js');
+const require_primordials_regexp = require('../../primordials/regexp.js');
+const require_paths_predicates = require('../../paths/predicates.js');
+const require_node_fs = require('../../node/fs.js');
+const require_node_path = require('../../node/path.js');
+const require_bin_which = require('../../bin/which.js');
+const require_process_abort = require('../abort.js');
+const require_node_child_process = require('../../node/child-process.js');
+const require_objects_inspect = require('../../objects/inspect.js');
+const require_spinner_default = require('../../spinner/default.js');
+const require_process_spawn__internal = require('./_internal.js');
+const require_process_spawn_errors = require('./errors.js');
+const require_process_spawn_stdio = require('./stdio.js');
+let node_process = require("node:process");
+node_process = require_runtime.__toESM(node_process);
+
+//#region src/process/spawn/child.ts
+/**
+* @file Child process spawning utilities with cross-platform support. Provides
+*   enhanced spawn functionality with stdio handling and error management.
+*   SECURITY: Array-Based Arguments Prevent Command Injection This module uses
+*   array-based arguments for all command execution, which is the PRIMARY
+*   DEFENSE against command injection attacks. When you pass arguments as an
+*   array to spawn(): spawn('npx', ['sfw', tool, ...args], { shell: true })
+*   Node.js handles escaping automatically. Each argument is passed directly to
+*   the OS without shell interpretation. Shell metacharacters like ; | & $ ( )
+*   ` are treated as LITERAL STRINGS, not as commands. This approach is secure
+*   even when shell: true is used on Windows for .cmd/.bat file resolution.
+*   UNSAFE ALTERNATIVE (not used in this codebase): spawn(`npx sfw ${tool}
+*   ${args.join(' ')}`, { shell: true }) // ✖ VULNERABLE String concatenation
+*   allows injection. For example, if tool = "foo; rm -rf /", the shell would
+*   execute both commands. Array-based arguments prevent this. References:
+*
+*   - https://nodejs.org/api/child_process.html#child_processspawncommand-args-options
+*   - https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html
+*/
+const abortSignal = require_process_abort.getAbortSignal();
+const spinner = require_spinner_default.getDefaultSpinner();
 function spawn(cmd, args, options, extra) {
-  const {
-    spinner: optionsSpinner = spinner,
-    stripAnsi: shouldStripAnsi = true,
-    ...rawSpawnOptions
-  } = { __proto__: null, ...options };
-  const spinnerInstance = optionsSpinner;
-  const spawnOptions = { __proto__: null, ...rawSpawnOptions };
-  const { env, shell, stdio, stdioString = true } = spawnOptions;
-  const cwd = spawnOptions.cwd ? String(spawnOptions.cwd) : void 0;
-  let actualCmd = cmd;
-  if (!(0, import_normalize.isPath)(cmd)) {
-    const fs = (0, import_fs.getNodeFs)();
-    const cached = import_internal.spawnBinPathCache.get(cmd);
-    if (cached) {
-      if (fs.existsSync(cached)) {
-        actualCmd = cached;
-      } else {
-        import_internal.spawnBinPathCache.delete(cmd);
-      }
-    }
-    if (actualCmd === cmd) {
-      const resolved = (0, import_which.whichSync)(cmd, { cwd, nothrow: true });
-      if (resolved && typeof resolved === "string") {
-        actualCmd = resolved;
-        import_internal.spawnBinPathCache.set(cmd, resolved);
-      }
-    }
-  }
-  const WIN32 = import_node_process.default.platform === "win32";
-  if (WIN32 && shell && (0, import_regexp.RegExpPrototypeTest)(import_internal.windowsScriptExtRegExp, actualCmd)) {
-    if (!(0, import_normalize.isPath)(actualCmd)) {
-      actualCmd = (0, import_path.getNodePath)().basename(
-        actualCmd,
-        (0, import_path.getNodePath)().extname(actualCmd)
-      );
-    }
-  }
-  const wasSpinning = !!spinnerInstance?.isSpinning;
-  const shouldStopSpinner = wasSpinning && !(0, import_stdio.isStdioType)(stdio, "ignore") && !(0, import_stdio.isStdioType)(stdio, "pipe");
-  const shouldRestartSpinner = shouldStopSpinner;
-  if (shouldStopSpinner) {
-    spinnerInstance.stop();
-  }
-  const envToUse = env ? {
-    __proto__: null,
-    ...import_node_process.default.env,
-    ...env
-  } : import_node_process.default.env;
-  const promiseSpawnOpts = {
-    __proto__: null,
-    cwd: typeof spawnOptions.cwd === "string" ? spawnOptions.cwd : void 0,
-    env: envToUse,
-    signal: abortSignal,
-    stdio: spawnOptions.stdio,
-    stdioString,
-    shell: spawnOptions.shell,
-    windowsVerbatimArguments: spawnOptions.windowsVerbatimArguments,
-    timeout: spawnOptions.timeout,
-    uid: spawnOptions.uid,
-    gid: spawnOptions.gid
-  };
-  const npmCliPromiseSpawn = (0, import_internal.getNpmCliPromiseSpawn)();
-  const spawnPromise = npmCliPromiseSpawn(
-    actualCmd,
-    args ? [...args] : [],
-    promiseSpawnOpts,
-    extra
-  );
-  const oldSpawnPromise = spawnPromise;
-  let newSpawnPromise;
-  if (shouldStripAnsi && stdioString) {
-    newSpawnPromise = (async () => {
-      try {
-        const result = await spawnPromise;
-        const strippedResult = (0, import_internal.stripAnsiFromSpawnResult)(result);
-        if ("code" in strippedResult) {
-          ;
-          strippedResult.exitCode = strippedResult.code;
-        }
-        return strippedResult;
-      } catch (error) {
-        const strippedError = (0, import_internal.stripAnsiFromSpawnResult)(error);
-        throw (0, import_errors.enhanceSpawnError)(strippedError);
-      }
-    })();
-  } else {
-    newSpawnPromise = (async () => {
-      try {
-        const result = await spawnPromise;
-        if (result !== null && typeof result === "object" && "code" in result) {
-          const res = result;
-          res.exitCode = res.code;
-          return res;
-        }
-        return result;
-      } catch (error) {
-        throw (0, import_errors.enhanceSpawnError)(error);
-      }
-    })();
-  }
-  if (shouldRestartSpinner) {
-    const prevPromise = newSpawnPromise;
-    newSpawnPromise = (async () => {
-      try {
-        return await prevPromise;
-      } finally {
-        spinnerInstance.start();
-      }
-    })();
-  }
-  ;
-  newSpawnPromise.process = oldSpawnPromise.process;
-  newSpawnPromise.stdin = oldSpawnPromise.stdin;
-  return newSpawnPromise;
+	const { spinner: optionsSpinner = spinner, stripAnsi: shouldStripAnsi = true, ...rawSpawnOptions } = {
+		__proto__: null,
+		...options
+	};
+	const spinnerInstance = optionsSpinner;
+	const spawnOptions = {
+		__proto__: null,
+		...rawSpawnOptions
+	};
+	const { env, shell, stdio, stdioString = true } = spawnOptions;
+	const cwd = spawnOptions.cwd ? String(spawnOptions.cwd) : void 0;
+	let actualCmd = cmd;
+	if (!/* @__PURE__ */ require_paths_predicates.isPath(cmd)) {
+		const fs = /* @__PURE__ */ require_node_fs.getNodeFs();
+		const cached = require_process_spawn__internal.spawnBinPathCache.get(cmd);
+		/* c8 ignore start */
+		if (cached) if (fs.existsSync(cached)) actualCmd = cached;
+		else require_process_spawn__internal.spawnBinPathCache.delete(cmd);
+		if (actualCmd === cmd) {
+			const resolved = require_bin_which.whichSync(cmd, {
+				cwd,
+				nothrow: true
+			});
+			if (resolved && typeof resolved === "string") {
+				actualCmd = resolved;
+				require_process_spawn__internal.spawnBinPathCache.set(cmd, resolved);
+			}
+		}
+	}
+	/* c8 ignore start - Windows-only cmd.exe extension stripping for
+	.cmd/.bat/.ps1 shell-true execution. Tested on Windows runners. */
+	if (node_process.default.platform === "win32" && shell && require_primordials_regexp.RegExpPrototypeTest(require_process_spawn__internal.windowsScriptExtRegExp, actualCmd)) {
+		if (!/* @__PURE__ */ require_paths_predicates.isPath(actualCmd)) actualCmd = (/* @__PURE__ */ require_node_path.getNodePath()).basename(actualCmd, (/* @__PURE__ */ require_node_path.getNodePath()).extname(actualCmd));
+	}
+	const shouldStopSpinner = !!spinnerInstance?.isSpinning && !/* @__PURE__ */ require_process_spawn_stdio.isStdioType(stdio, "ignore") && !/* @__PURE__ */ require_process_spawn_stdio.isStdioType(stdio, "pipe");
+	const shouldRestartSpinner = shouldStopSpinner;
+	if (shouldStopSpinner) spinnerInstance.stop();
+	const envToUse = env ? {
+		__proto__: null,
+		...node_process.default.env,
+		...env
+	} : node_process.default.env;
+	const promiseSpawnOpts = {
+		__proto__: null,
+		cwd: typeof spawnOptions.cwd === "string" ? spawnOptions.cwd : void 0,
+		env: envToUse,
+		signal: abortSignal,
+		stdio: spawnOptions.stdio,
+		stdioString,
+		shell: spawnOptions.shell,
+		windowsVerbatimArguments: spawnOptions.windowsVerbatimArguments,
+		timeout: spawnOptions.timeout,
+		uid: spawnOptions.uid,
+		gid: spawnOptions.gid
+	};
+	const spawnPromise = (/* @__PURE__ */ require_process_spawn__internal.getNpmCliPromiseSpawn())(actualCmd, args ? [...args] : [], promiseSpawnOpts, extra);
+	/* c8 ignore stop */
+	const oldSpawnPromise = spawnPromise;
+	/* c8 ignore start */
+	let newSpawnPromise;
+	if (shouldStripAnsi && stdioString) newSpawnPromise = (async () => {
+		try {
+			const strippedResult = /* @__PURE__ */ require_process_spawn__internal.stripAnsiFromSpawnResult(await spawnPromise);
+			if ("code" in strippedResult) strippedResult.exitCode = strippedResult.code;
+			return strippedResult;
+		} catch (error) {
+			throw /* @__PURE__ */ require_process_spawn_errors.enhanceSpawnError(/* @__PURE__ */ require_process_spawn__internal.stripAnsiFromSpawnResult(error));
+		}
+	})();
+	else newSpawnPromise = (async () => {
+		try {
+			const result = await spawnPromise;
+			if (result !== null && typeof result === "object" && "code" in result) {
+				const res = result;
+				res.exitCode = res.code;
+				return res;
+			}
+			return result;
+		} catch (error) {
+			throw /* @__PURE__ */ require_process_spawn_errors.enhanceSpawnError(error);
+		}
+	})();
+	/* c8 ignore stop */
+	if (shouldRestartSpinner) {
+		const prevPromise = newSpawnPromise;
+		newSpawnPromise = (async () => {
+			try {
+				return await prevPromise;
+			} finally {
+				spinnerInstance.start();
+			}
+		})();
+	}
+	newSpawnPromise.process = oldSpawnPromise.process;
+	newSpawnPromise.stdin = oldSpawnPromise.stdin;
+	return newSpawnPromise;
 }
 function spawnSync(cmd, args, options) {
-  let actualCmd = cmd;
-  if (!(0, import_normalize.isPath)(cmd)) {
-    const resolved = (0, import_which.whichSync)(cmd, {
-      cwd: (0, import_inspect.getOwn)(options, "cwd"),
-      nothrow: true
-    });
-    if (resolved && typeof resolved === "string") {
-      actualCmd = resolved;
-    }
-  }
-  const shell = (0, import_inspect.getOwn)(options, "shell");
-  const WIN32 = import_node_process.default.platform === "win32";
-  if (WIN32 && shell && (0, import_regexp.RegExpPrototypeTest)(import_internal.windowsScriptExtRegExp, actualCmd)) {
-    if (!(0, import_normalize.isPath)(actualCmd)) {
-      actualCmd = (0, import_path.getNodePath)().basename(
-        actualCmd,
-        (0, import_path.getNodePath)().extname(actualCmd)
-      );
-    }
-  }
-  const { stripAnsi: shouldStripAnsi = true, ...rawSpawnOptions } = {
-    __proto__: null,
-    ...options
-  };
-  const { stdioString: rawStdioString = true } = rawSpawnOptions;
-  const rawEncoding = rawStdioString ? "utf8" : "buffer";
-  const spawnOptions = {
-    encoding: rawEncoding,
-    ...rawSpawnOptions
-  };
-  const stdioString = spawnOptions.encoding !== "buffer";
-  const result = (0, import_child_process.getNodeChildProcess)().spawnSync(actualCmd, args, spawnOptions);
-  if (stdioString) {
-    const { stderr, stdout } = result;
-    if (stdout) {
-      result.stdout = stdout.toString().trim();
-    }
-    if (stderr) {
-      result.stderr = stderr.toString().trim();
-    }
-  }
-  return shouldStripAnsi && stdioString ? (0, import_internal.stripAnsiFromSpawnResult)(result) : result;
+	let actualCmd = cmd;
+	if (!/* @__PURE__ */ require_paths_predicates.isPath(cmd)) {
+		const resolved = require_bin_which.whichSync(cmd, {
+			cwd: /* @__PURE__ */ require_objects_inspect.getOwn(options, "cwd"),
+			nothrow: true
+		});
+		if (resolved && typeof resolved === "string") actualCmd = resolved;
+	}
+	const shell = /* @__PURE__ */ require_objects_inspect.getOwn(options, "shell");
+	/* c8 ignore start - Windows-only cmd.exe extension stripping for
+	.cmd/.bat/.ps1 shell-true execution. Tested on Windows runners. */
+	if (node_process.default.platform === "win32" && shell && require_primordials_regexp.RegExpPrototypeTest(require_process_spawn__internal.windowsScriptExtRegExp, actualCmd)) {
+		if (!/* @__PURE__ */ require_paths_predicates.isPath(actualCmd)) actualCmd = (/* @__PURE__ */ require_node_path.getNodePath()).basename(actualCmd, (/* @__PURE__ */ require_node_path.getNodePath()).extname(actualCmd));
+	}
+	/* c8 ignore stop */
+	const { stripAnsi: shouldStripAnsi = true, ...rawSpawnOptions } = {
+		__proto__: null,
+		...options
+	};
+	const { stdioString: rawStdioString = true } = rawSpawnOptions;
+	const spawnOptions = {
+		encoding: rawStdioString ? "utf8" : "buffer",
+		...rawSpawnOptions
+	};
+	const stdioString = spawnOptions.encoding !== "buffer";
+	const result = (/* @__PURE__ */ require_node_child_process.getNodeChildProcess()).spawnSync(actualCmd, args, spawnOptions);
+	if (stdioString) {
+		const { stderr, stdout } = result;
+		if (stdout) result.stdout = stdout.toString().trim();
+		if (stderr) result.stderr = stderr.toString().trim();
+	}
+	return shouldStripAnsi && stdioString ? /* @__PURE__ */ require_process_spawn__internal.stripAnsiFromSpawnResult(result) : result;
 }
-// Annotate the CommonJS export names for ESM import in node:
-0 && (module.exports = {
-  spawn,
-  spawnSync
-});
+
+//#endregion
+exports.spawn = spawn;
+exports.spawnSync = spawnSync;